REGULATION
DORA
An EU regulation for digital operational resilience in the financial sector.
DEFINITION
DORA definition
The Digital Operational Resilience Act, or DORA, sets a common European Union framework for managing information and communication technology risk in financial entities and certain technology providers. It covers governance, incidents, resilience testing and third-party risk. The legal obligations belong to the client; Cinderpath builds and operates technical controls that can support compliance work.
WHY IT MATTERS NOW
The current operating pressure
Regulatory fact, European Commission: DORA has applied since 17 January 2025. In-scope organisations need operating evidence that connects written policy to incident handling, testing, recovery and supplier oversight.
WHAT WE DO ABOUT IT
Work connected to DORA
Audit evidence
The logs, records and supplier map an auditor asks for, produced as a by-product of normal operation.
NIS2 and DORA readiness
A gap assessment and a technical plan against NIS2, DORA and the EU AI Act. The obligations stay yours, the controls are ours to build.
NEIGHBOURING TAGS
Shared parts of the map
Trace the shared concern through your systems
Bring the system boundary and the decisions that need evidence. We will identify the connected work and define a practical starting point.